🔐 Security & Audit AI Skills

Security gate for skills. Every new skill MUST pass SkillScan before use. Activate on any install, load, add, evaluate, or safety question about a skill. On...

Audit codebases and infrastructure for security issues. Use when scanning dependencies for vulnerabilities, detecting hardcoded secrets, checking OWASP top 10 issues, verifying SSL/TLS, auditing file permissions, or reviewing code for injection and auth flaws.

Comprehensive security auditing for Clawdbot deployments. Scans for exposed credentials, open ports, weak configs, and vulnerabilities. Auto-fix mode included.

Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope,...

Provide file protection while users work with openclaw. All file operations are version-indexed and support delete recovery and modification rollback.

Memory and defence for AI agents: semantic recall, knowledge graph and decay, plus a memory firewall that scans and enforces against prompt injection, credential leaks and poisoning.

无损回忆技能。对对话或会话记录做本地蒸馏，提取身份信息、偏好、任务和长期知识，剔除噪声并保留可追溯日志。

Solve CAPTCHAs with 2Captcha from the command line during browser automation.

AI runtime security monitoring — context graph analysis, runtime audit log correlation with CVE findings, and vulnerability analytics queries. Use when the user mentions runtime monitoring, context graphs, lateral movement analysis, audit log correlation, or vulnerability analytics.

Free, local, read-only security self-audit for your own OpenClaw agent. Reads your OpenClaw config, bootstrap files, logs, agent session logs, and installed skills, plus a bounded host-security scan. It changes no OpenClaw config, skill or bootstrap file; its own history and state stay under ~/.clawseccheck (--no-history skips it, --purge removes it). Grades your setup A-F when all five check layers ran, naming what's missing otherwise. --monitor records a local baseline so every later run alerts on what changed - a new MCP server, an edited skill, config drift, a finding that appeared or cleared. No API key, no network calls; the only external command it runs is your own read-only openclaw security audit (skip with --no-native). --save and --html write only to the path you give. Use it when you want to check or audit your OpenClaw agent's security, find prompt-injection or misconfiguration risks, see your A-F security score, watch your OpenClaw setup for changes, or ask what changed since the last check.

Detect anomalies and outliers in construction data: unusual costs, schedule variances, productivity spikes. Statistical and ML-based detection methods.

Efficient, secure agent-to-agent communication protocol. 40-60% token reduction, built-in privacy, Ed25519 signatures.

Security-focused code review for hardcoded secrets, dangerous calls, and common vulnerabilities

Call any API without leaking credentials. Keychains proxies requests and injects real tokens server-side — your agent never sees them.

Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope,...

Evaluates business workflows across 8 areas to identify automation opportunities, estimate time and cost savings, and prioritize processes by ROI for digital...

Detect 500+ types of hardcoded secrets (API keys, credentials, tokens) before they leak into git. Wraps GitGuardian's ggshield CLI.

Tamper-resistant audit watchdog for Clawdbot agents. Detects and logs suspicious filesystem activity with HMAC-chained evidence.

Use this skill whenever the user needs to perform VMware cyber compliance auditing (aligned with VCF 9 Advanced Cyber Compliance / ACC), baseline checking, or drift detection on vSphere/ESXi/NSX environments. Directly handles: CIS / vSphere SCG / 等保 2.0 三级 / PCI-DSS / BSI IT-Grundschutz / EU NIS2 scans; known-vulnerability (VMSA) matching of ESXi/vCenter builds; custom YAML baselines; LLM-driven remediation suggestions; web dashboard. Always use this skill for "scan compliance", "check baseline", "audit etcd", "check 等保", "drift detection", "compliance report", "cyber compliance scan", "ACC posture", "STIG check", "check VMSA", "known vulnerabilities" when the context is explicitly VMware/vSphere/ESXi. Do NOT use for general vSphere monitoring (use vmware-monitor or vmware-aiops), network changes (use vmware-nsx), or executing remediations directly (this skill only suggests; execution goes through vmware-pilot).

AI Company CISOsecurity门禁模块v2.1.0。STRIDE威胁建模、CVSS漏洞评分、security红线审查、最终发布审查、CEO-EXEC危机直通接口security规范。 触发关键词：security审查、security检查、漏洞扫描、威胁建模、危机直通、双重审批

Scan websites and content to identify SEO gaps, analyze meta tags, technical factors, keyword use, and provide competitor comparison insights.

Performs adversarial red-team analysis on approved plans to identify edge cases, security risks, scalability issues, error paths, and integration risks befor...

Authenticate and verify Molt agent requests using Ed25519 signatures for secure, token-free access and universal identity across Molt Apps.

Use agent-bom to check package, SBOM, inventory, and agent dependency exposure against OSV, GitHub Security Advisories, NVD, EPSS, and CISA KEV with explicit data-boundary choices. Use when a user asks for CVE lookup, advisory intelligence, exploitability context, fix versions, GHSA/OSV/NVD enrichment, or package vulnerability triage.